In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allows remote attackers to cause a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagick6 | Oct 1, 2024 | Jan 30, 2018 |
| Debian | — | Upgrade imagemagick | Jul 30, 2024 | Jan 30, 2018 |
| Huawei Euleros 2_0_sp2 | — | — | Dec 4, 2019 | Jan 30, 2018 |
| Huawei Euleros 2_0_sp3 | — | — | Apr 16, 2020 | Jan 30, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 30, 2018 |
| Suse | — | Upgrade libMagickWand1Upgrade libGraphicsMagick2Upgrade libmagickwand-6_q16-1Upgrade imagemagick-config-6-suseUpgrade libMagickWand1-32bitUpgrade imagemagick-develUpgrade perl-perlmagickUpgrade libMagickCore1-32bitUpgrade imagemagickUpgrade libmagick-develUpgrade libMagickCore1Upgrade libmagick-6_q16-3Upgrade libmagickcore-6_q16-1-32bitUpgrade perl-graphicsmagickUpgrade libMagick++1Upgrade graphicsmagickUpgrade libmagickcore-6_q16-1Upgrade imagemagick-config-6-upstream | Feb 21, 2018 | Jan 30, 2018 |
| Ubuntu | — | Upgrade libmagickcore5-extraUpgrade imagemagickUpgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore-6.q16-2Upgrade libmagickcore5Upgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-2-extraUpgrade imagemagick-6.q16Upgrade libmagickcore-6.q16-3Upgrade libmagick++5Upgrade libmagick++-6.q16-7 | Jun 19, 2018 | Jan 30, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub